From 9bc841226d8a63aaa59fc6b26a4452fe548c6589 Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Mon, 31 Aug 2026 21:04:44 +0800 Subject: [PATCH] lib: utils/mailbox: Reject invalid RPMI queue indices The RPMI shared-memory helpers validate a queue index before using it to select queue_ctx_tbl, but the current comparison accepts queue_id equal to queue_count. Only entries 0 through queue_count - 1 are initialized from the device tree. Accepting queue_count can therefore use an uninitialized queue context when a protocol operation selects a queue omitted by the description. Reject queue_id greater than or equal to queue_count in both transfer directions. Fixes: 91f46fb47eef ("lib/utils: Add RPMI messaging protocol and shared memory transport support") Signed-off-by: Pengpeng Hou Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260831130444.53629-1-pengpeng@iscas.ac.cn Signed-off-by: Anup Patel --- lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c b/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c index ecac100f..21330c4b 100644 --- a/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c +++ b/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c @@ -316,7 +316,7 @@ static int smq_rx(struct rpmi_shmem_mbox_controller *mctl, int ret, rxretry = 0; struct smq_queue_ctx *qctx; - if (mctl->queue_count < queue_id) { + if (queue_id >= mctl->queue_count) { sbi_printf("%s: invalid queue_id or service_group_id\n", __func__); return SBI_EINVAL; @@ -351,7 +351,7 @@ static int smq_tx(struct rpmi_shmem_mbox_controller *mctl, int ret, txretry = 0; struct smq_queue_ctx *qctx; - if (mctl->queue_count < queue_id) { + if (queue_id >= mctl->queue_count) { sbi_printf("%s: invalid queue_id or service_group_id\n", __func__); return SBI_EINVAL;